whats been forgotten here is that MS never distribute patches via email, so even if an authentic looking email containing a patch/program comes from MS, it won't actually be from them.